If you haven't already seen this, it might be useful:

http://www.windowsecurity.com/articl...08-part-1.html